D: gcp best practices, not use internal ip unless strickly necessary

D makes most sense

The correct answer is C. Specify an authorized network with the CIDR range of the VM.

D. It is always more secure to use an internal IP, so removing them doesn’t make sense. Eliminate A. You can use Private Google Access when VM instances only have internal IP addresses, so disabling the internal IPs and use Private Google Access doesn’t make sense. Eliminate B. Specifying an authorized network when they’re on the same subnet doesn’t make sense. Eliminate C. A way to improve network security would be to disable external IPs since they’re not needed.

D as both are in VPC they can communicate internally. Private Google Access enabled allows VM instances which only have internal IP addresses (no external IP addresses) to reach the external IP addresses of Google APIs and services

D. Within VPC, all traffic is open

B is not applicable here because Private Google Access requires internal IP address.

B: Disable both the external IP address and the internal IP address, and instead rely on *** Private Google Access.